AI GRC Specialist

About Us – Who We Are

ProductSquads was founded with a bold mission: to engineer capital efficiency through autonomous AI agents, exceptional engineering, and real-time decision intelligence.

We’re building an AI-native platform that redefines how software teams deliver value — whether through code written by humans, agents, or both. Our technology stack combines agentic AI systems, ML pipelines, and high-performance engineering workflows.

This is your chance to build not just models, but systems that think, decide, and act — AI fabric tools, domain-intelligent agents, and real-time decision systems that power the next generation of product delivery.

The Role – What You’ll Do

Role Purpose

Own trust assurance workflows from intake through decision and closure. The AI GRC Specialist delivers accurate customer security questionnaire responses, coordinates security contributions to RFPs, reviews security content in customer addendums, runs vendor risk assessments, maintains the company risk register, and leads at least one certification workstream.

The role uses AI to improve the complete GRC workflow, not simply to process more requests. It applies the time saved to risk analysis, vendor follow-through, and certification closure. The Specialist makes clear, business-focused recommendations and works with limited day-to-day supervision.

Role at a Glance

• Function: Governance, Risk and Compliance (GRC) / Security Assurance
• Level: Individual Contributor
• Experience: 8+ years of relevant experience
• Reports To: CISO or designated security leader
• Core Scope: Customer assurance, vendor risk, risk register, certification workstream, and AI-assisted GRC improvement

Responsibilities – Your Scope

1. Customer and Sales Assurance

• Own security questionnaire delivery from intake to submission, including prioritization, customer follow-up, service levels, and answer quality.
• Coordinate security responses and evidence for RFPs owned by Sales or the business team. The Specialist does not own the overall RFP.
• Review and respond to security and risk provisions in customer addendums. Engage Legal for contractual terms outside the security scope.
• Maintain the security answer library and verify that standard answers reflect current controls and evidence.

1. Vendor Risk and Risk Register

• Run the vendor risk program, including tiering, due diligence, assessments, risk ratings, remediation tracking, and reassessment cadence.
• Lead assessments for high-risk vendors and coordinate evidence or action plans with relevant internal owners.
• Maintain the risk register in the company GRC platform by documenting risks, assigning owners, tracking treatment, and providing leadership with a current view of the organization’s risk posture.

1. Certifications and Control Assurance

• Own at least one certification workstream, such as SOC 2, ISO 42001, or TISAX, from gap assessment through auditor closure. Support other assurance activities as needed.
• Coordinate control owners, evidence collection, remediation, and audit follow-up while keeping status and dependencies visible.

1. AI-Assisted GRC Operations

• Improve workflows for questionnaire drafting, vendor document review, control mapping, and evidence reuse, with feedback loops that make subsequent cycles more accurate.
• Measure changes in manual effort and answer accuracy, and demonstrate how the capacity released is redirected to risk analysis and closure activities.
• Coach Analysts on quality, escalation, and identifying manual steps that can be simplified or automated.

What This Role Is Not

• A questionnaire-processing role measured by volume alone; accuracy, risk insight, and closure matter.
• The owner of end-to-end RFP delivery; the role provides security content and supporting evidence.
• A legal reviewer or the final decision-maker for accepting company risk.
• A security engineering role. Engineers build and enforce technical controls; this role verifies evidence, tracks gaps, and escalates issues where controls are not operating as expected.
• A gatekeeper that slows sales or procurement. The role balances timely responses with reliable, supportable answers.

Ownership – Decision Rights and Deliverables

Decision Rights

Decides / Owns

• Questionnaire workflow, answer-library maintenance, assessment execution, and risk-register quality.
• Vendor tiering and reassessment cadence within approved policy.
• GRC workflow…